MANDATORY BREACH REPORTING: REVIEW OF THE REQUIREMENTS UNDER PHIPA - PowerPoint PPT Presentation

MANDATORY BREACH REPORTING: REVIEW OF THE REQUIREMENTS UNDER PHIPA

OVERVIEW OF BREACH NOTIFICATION AND IPC STATISTICS • Fida Hindi, Legal Counsel Office of the Information and Privacy Commissioner of Ontario • This presentation is provided for educational purposes and is not legal advice

BREACH NOTIFICATION • Pre-Existing: – A health information custodian must notify an affected individual at the first reasonable opportunity if personal health information in its custody or control is stolen, lost or used or disclosed without authority • In addition: – A cust odian must not ify t he IPC if t he circumst ances surrounding t he t heft , loss or unaut horized use or disclosure meet t he prescribed requirements – A cust odian must also, on or before March 1 in each year st art ing in 2019, provide t he IPC wit h a st at ist ical report of breaches in t he previous calendar year

NOTIFICATION TO REGULATORY COLLEGES • Custodian must provide written notice to regulatory College where a health care practitioner the custodian employs or that the custodian extends privileges to, or is otherwise affiliated with: – is terminated, suspended, subj ect to disciplinary action or member’s privileges are revoked, suspended or restricted, or his or her affiliation is revoked, suspended or restricted, as a result of a breach – resigns or relinquishes/ voluntarily restricts his or her privileges or his or her affiliation and custodian has reasonable grounds to believe that this is related to an investigation or other action by the custodian with respect to a breach

PRESCRIBED REQUIREMENTS Y ou must notify the IPC in cases of: 1. use or disclosure without authority 2. stolen information 3. further use or disclosure without authority after a breach 4. pattern of similar breaches 5. disciplinary action against a college member 6. disciplinary action against a non- college member 7. significant breach

STATISTICS The total number of breaches reported between October 1, 2017- December 31, 2017 represents a 115% increase over the same period in the previous year.

HEALTH SECTOR PRIVACY COMPLAINTS 2017 7% Of the 324 self-reported (47) breaches: • 60 snooping incidents 25% • 8 ransomware/cyberattack (155) 51% Remaining 256 were: (324) • lost or stolen PHI • misdirected PHI 17% • records not properly (105) secured • other collection, use and disclosure issues Self-Reported Breach Collection-Use-Disclosure Access/Correction IPC Initiated

SELF REPORTED BREACHES IN 2018 • 185 self-reported breaches in 2018: – 72 misdirected/lost PHI – 38 snooping incidents – 34 general collection, use and disclosure issues – 20 stolen PHI – 8 lost or stolen mobile devices – 8 records not properly secured – 4 ransomware/cyberattack

ANNUAL STATISTICAL REPORTS TO THE COMMISSIONER • Custodians will be required to: – S t art t racking privacy breach st at ist ics as of January 1, 2018 – Provide t he Commissioner wit h an annual report of t he previous calendar year’s st at ist ics, st art ing in March 2019

THANK YOU Office of the Information and Privacy Commissioner of Ontario 2 Bloor S treet East, S uite 1400 Toronto, Ontario, Canada M4W 1A8 Phone: (416) 326-3333 / 1-800-387-0073 TDD/ TTY : 416-325-7539 Web: www.ipc.on.ca E-mail: info@ ipc.on.ca Media: media@ ipc.on.ca / 416-326-3965

PRACTICAL TOOLS FOR BREACH NOTIFICATION • Natalie Comeau, CIPP/ C, Manager, Privacy, FIPP A & Information Access Providence S t. Joseph’s and S t. Michael’s Healthcare • Mary Jane Dykeman, Partner DDO Health Law

A HIC EXPERIENCE • Providence Healthcare, S t. Joseph’s Health Centre and S t. Michael’s Hospital integrated into one network on August 1, 2017

THE PLAN • Institutional template for IPC questions • Process for review and escalation • New log to track all breaches, including: – References to incident reporting systems – Institutional metrics (e.g. affected department, date of patient notification) – IPC metrics for annual report (e.g. PHIP A breach category)

THE JOURNEY INCLUDED… • Defining (and re-defining) t he organizat ion’s risk t olerance & risk cat egories – Low = few impacted patients, unintentional violation, minimally sensitive PHI, and no anticipated harm – Medium = many impacted patients, negligent or repeated violation, moderately sensitive PHI, or potential harm – High = large number of impacted patients, intentional violation, most sensitive PHI, or patient harmed (* or IPC involvement)

IT’S AN OPPORTUNITY TO… • S ocialize breach definitions and examples Type Notice/report required Notice/report at the HIC’s Policy/contractual discretion violation Theft Theft of an unencrypted Loss of an encrypted device Theft of PHI in the custody of another HIC device containing PHI containing PHI Unauthorized Accessing a locked record Sending a record of PHI in Individual accesses their Use without consent or a error to another agent (e.g. own record directly significant risk of harm internal staff) (against hospital policy) Unauthorized Sending a record of PHI to PHI sent to the right Temporary unsecure Disclosure an unintended recipient provider at the wrong storage, without that was opened, read or location evidence of otherwise collected inappropriate access

LESSONS LEARNED • S taff learned the right thing to do when learning about what can go wrong (& how to prevent common mistakes) • Increased staff ownership & engagement • No decrease in breach reporting • Culture matters

PRIVACY OFFICER QUESTIONS • Many privacy officers in Ontario wear multiple other hats in the health care organization • S ome do not have robust systems for tracking breaches • Turnover in the role is very high in some organizations resulting in lost legacy

CAUTIONARY TALES • Important to recognize the nuances IPC is providing as breach reporting matures • Remember that even if not reportable to IPC, the duty under s. 12(2) of PHIP A to give notice to the affected individual remains (e.g. accidental breach) • Issues in determining whether a breach is part of a pattern or was it accidental/ inadvertent?

PRACTICAL APPROACHES • They are asking: – How do we make breach reporting seamless? – What are other organizations doing? – What templates are being used? (e.g., OHA) – What’s the difference between mandatory breach to IPC and the annual statistical reporting? • Tracking as of January 1, 2018; reporting March 2019 and includes those breaches for which no mandatory report was made to IPC

THANK YOU Natalie Comeau, CIPP/C, Manager, 416-557-9163 Privacy, FIPPA & Information Access – comeau@smh.ca Providence Healthcare, St. Joseph's Health Centre & St. Michael's Hospital Mary Jane Dykeman, Partner - DDO 416-967-7100 ext. 225 Health Law mjdykeman@ddohealthlaw.com

HOW DID THINGS GO? (WE REALLY WANT TO KNOW) Did you enj oy this session? Is there any way we could make it better? Let us know by filling out a speaker evaluation. • S tart by opening the IAPP Events App • S elect this session and tap “ Rate the S ession” • Once you’ ve answered all three questions, tap “ Done” and you’ re all set • Thank you!